3 ms·
Maybe they were just automatically signing it as a a CI/CD step?
by vsareto 6y ago
Maybe they were just automatically signing it as a a CI/CD step?
- EvanAnderson 6y agoI would love to see a postmortem for how they were handling their code signing cert. Right now I get a "PFX file on a network share and everybody knows the password" kind of feeling.
- dane-pgp 6y agoMaybe after signing it (but before releasing it), the CI/CD should upload the signed hash to an independent third-party publicly-accessible append-only log (like Certificate Transparency). Assuming the binary is reproducibly buildable, different internal teams can try rebuilding the source and checking that the signature matches what's in the public log, and that each entry in the log has a corresponding commit in the source repo.